Cloudanix VulnDB

CVE-2024-56180

Critical · 9.8

Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

CVSS

9.8

EPSS

0.8%

Published

Feb 14, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in Apache EventMesh lets attackers run their own programs on the server by sending specially made messages, which could let them steal data or take over systems.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Deserialization
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Deserialization of untrusted data in the eventmesh-meta-raft plugin allows remote code execution via the Hessian RPC protocol on Windows, Linux, and macOS platforms.

Why it matters to the business

Attackers can gain full control of affected EventMesh instances, leading to data breaches, service disruption, or use as a foothold for further network attacks; the high CVSS score and public availability of details increase urgency despite low EPSS.

How an attack unfolds

An attacker crafts a malicious serialized object and sends it over the Hessian deserialization RPC protocol to the vulnerable raft plugin module, triggering arbitrary code execution without authentication.

How to fix it

Upgrade apache/eventmesh to commit 1bf8616001e9ca10db37942b779e1a23616552a9 or version 1.11.0 and hubble-ui (Bitnami) to 1.13.14; disable the eventmesh-meta-raft plugin if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the installed version or commit hash matches a fixed release, review plugin configuration to confirm the raft module is updated, and test RPC endpoints for safe deserialization handling.

Typical attack path

  1. Locate publicly reachable Apache EventMesh instances exposing the meta-raft RPC endpoint
  2. Craft and serialize a malicious payload using the Hessian protocol
  3. Transmit the payload in a controlled message to trigger deserialization
  4. Execute arbitrary code on the target system

How to detect it

Review application and RPC logs for unexpected Hessian protocol messages or deserialization errors originating from untrusted sources; inspect process execution following receipt of meta-raft plugin traffic.

What your security team should do

  • Apply the listed fixed versions immediately given the critical CVSS score
  • Monitor for any increase in EPSS or public exploit availability
  • Restrict network access to EventMesh RPC ports to trusted sources only
  • Audit downstream dependents for exposure due to ecosystem prevalence

The record

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.apache.eventmesh:eventmesh-meta-raft 1.10.1 1.11.0
maven org.apache.eventmesh/eventmesh-meta-raft 1.10.1 1.11.0

Related vulnerabilities